From: Sasha Levin Date: Sun, 29 Aug 2021 21:45:54 +0000 (-0400) Subject: Fixes for 4.14 X-Git-Tag: v4.4.283~55 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d264c3859f446da241656b96bc4d2a64cdf6776c;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch b/queue-4.14/e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch new file mode 100644 index 00000000000..1f384f3bbce --- /dev/null +++ b/queue-4.14/e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch @@ -0,0 +1,76 @@ +From 15145c479a00f88324a41d6d989fe51a5d2e1c82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jul 2021 10:11:41 +0300 +Subject: e1000e: Fix the max snoop/no-snoop latency for 10M + +From: Sasha Neftin + +[ Upstream commit 44a13a5d99c71bf9e1676d9e51679daf4d7b3d73 ] + +We should decode the latency and the max_latency before directly compare. +The latency should be presented as lat_enc = scale x value: +lat_enc_d = (lat_enc & 0x0x3ff) x (1U << (5*((max_ltr_enc & 0x1c00) +>> 10))) + +Fixes: cf8fb73c23aa ("e1000e: add support for LTR on I217/I218") +Suggested-by: Yee Li +Signed-off-by: Sasha Neftin +Tested-by: Dvora Fuxbrumer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/ich8lan.c | 14 +++++++++++++- + drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 +++ + 2 files changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c +index 1e990f9dd379..9d5fe4ea9cee 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c +@@ -1013,6 +1013,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) + { + u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) | + link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND; ++ u16 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */ ++ u16 lat_enc_d = 0; /* latency decoded */ + u16 lat_enc = 0; /* latency encoded */ + + if (link) { +@@ -1066,7 +1068,17 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) + E1000_PCI_LTR_CAP_LPT + 2, &max_nosnoop); + max_ltr_enc = max_t(u16, max_snoop, max_nosnoop); + +- if (lat_enc > max_ltr_enc) ++ lat_enc_d = (lat_enc & E1000_LTRV_VALUE_MASK) * ++ (1U << (E1000_LTRV_SCALE_FACTOR * ++ ((lat_enc & E1000_LTRV_SCALE_MASK) ++ >> E1000_LTRV_SCALE_SHIFT))); ++ ++ max_ltr_enc_d = (max_ltr_enc & E1000_LTRV_VALUE_MASK) * ++ (1U << (E1000_LTRV_SCALE_FACTOR * ++ ((max_ltr_enc & E1000_LTRV_SCALE_MASK) ++ >> E1000_LTRV_SCALE_SHIFT))); ++ ++ if (lat_enc_d > max_ltr_enc_d) + lat_enc = max_ltr_enc; + } + +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h +index 88df80c0894b..e32012d39827 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h +@@ -292,8 +292,11 @@ + + /* Latency Tolerance Reporting */ + #define E1000_LTRV 0x000F8 ++#define E1000_LTRV_VALUE_MASK 0x000003FF + #define E1000_LTRV_SCALE_MAX 5 + #define E1000_LTRV_SCALE_FACTOR 5 ++#define E1000_LTRV_SCALE_SHIFT 10 ++#define E1000_LTRV_SCALE_MASK 0x00001C00 + #define E1000_LTRV_REQ_SHIFT 15 + #define E1000_LTRV_NOSNOOP_SHIFT 16 + #define E1000_LTRV_SEND (1 << 30) +-- +2.30.2 + diff --git a/queue-4.14/ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch b/queue-4.14/ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch new file mode 100644 index 00000000000..c87e41b1ba6 --- /dev/null +++ b/queue-4.14/ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch @@ -0,0 +1,65 @@ +From 92865539997200faa466ce4058d7a16868662abf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Aug 2021 06:30:29 -0700 +Subject: IB/hfi1: Fix possible null-pointer dereference in + _extend_sdma_tx_descs() + +From: Tuo Li + +[ Upstream commit cbe71c61992c38f72c2b625b2ef25916b9f0d060 ] + +kmalloc_array() is called to allocate memory for tx->descp. If it fails, +the function __sdma_txclean() is called: + __sdma_txclean(dd, tx); + +However, in the function __sdma_txclean(), tx-descp is dereferenced if +tx->num_desc is not zero: + sdma_unmap_desc(dd, &tx->descp[0]); + +To fix this possible null-pointer dereference, assign the return value of +kmalloc_array() to a local variable descp, and then assign it to tx->descp +if it is not NULL. Otherwise, go to enomem. + +Fixes: 7724105686e7 ("IB/hfi1: add driver files") +Link: https://lore.kernel.org/r/20210806133029.194964-1-islituo@gmail.com +Reported-by: TOTE Robot +Signed-off-by: Tuo Li +Tested-by: Mike Marciniszyn +Acked-by: Mike Marciniszyn +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/sdma.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c +index 741938409f8e..c1c6d2c570aa 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.c ++++ b/drivers/infiniband/hw/hfi1/sdma.c +@@ -3067,6 +3067,7 @@ static void __sdma_process_event(struct sdma_engine *sde, + static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + { + int i; ++ struct sdma_desc *descp; + + /* Handle last descriptor */ + if (unlikely((tx->num_desc == (MAX_DESC - 1)))) { +@@ -3087,12 +3088,10 @@ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + if (unlikely(tx->num_desc == MAX_DESC)) + goto enomem; + +- tx->descp = kmalloc_array( +- MAX_DESC, +- sizeof(struct sdma_desc), +- GFP_ATOMIC); +- if (!tx->descp) ++ descp = kmalloc_array(MAX_DESC, sizeof(struct sdma_desc), GFP_ATOMIC); ++ if (!descp) + goto enomem; ++ tx->descp = descp; + + /* reserve last descriptor for coalescing */ + tx->desc_limit = MAX_DESC - 1; +-- +2.30.2 + diff --git a/queue-4.14/ip_gre-add-validation-for-csum_start.patch b/queue-4.14/ip_gre-add-validation-for-csum_start.patch new file mode 100644 index 00000000000..4e4c1b6cfed --- /dev/null +++ b/queue-4.14/ip_gre-add-validation-for-csum_start.patch @@ -0,0 +1,41 @@ +From df4780363e223926b09f4617f430872bf42b6964 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Aug 2021 12:44:24 +0530 +Subject: ip_gre: add validation for csum_start + +From: Shreyansh Chouhan + +[ Upstream commit 1d011c4803c72f3907eccfc1ec63caefb852fcbf ] + +Validate csum_start in gre_handle_offloads before we call _gre_xmit so +that we do not crash later when the csum_start value is used in the +lco_csum function call. + +This patch deals with ipv4 code. + +Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.") +Reported-by: syzbot+ff8e1b9f2f36481e2efc@syzkaller.appspotmail.com +Signed-off-by: Shreyansh Chouhan +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_gre.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 9940a59306b5..1a4d89f8361c 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -443,6 +443,8 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev, + + static int gre_handle_offloads(struct sk_buff *skb, bool csum) + { ++ if (csum && skb_checksum_start(skb) < skb->data) ++ return -EINVAL; + return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE); + } + +-- +2.30.2 + diff --git a/queue-4.14/net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch b/queue-4.14/net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch new file mode 100644 index 00000000000..df0246e7c6d --- /dev/null +++ b/queue-4.14/net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch @@ -0,0 +1,36 @@ +From 53b72e4a4e94cd099ae2679977b5cc4b015e018c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Aug 2021 18:39:51 +0300 +Subject: net: marvell: fix MVNETA_TX_IN_PRGRS bit number + +From: Maxim Kiselev + +[ Upstream commit 359f4cdd7d78fdf8c098713b05fee950a730f131 ] + +According to Armada XP datasheet bit at 0 position is corresponding for +TxInProg indication. + +Fixes: c5aff18204da ("net: mvneta: driver for Marvell Armada 370/XP network unit") +Signed-off-by: Maxim Kiselev +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvneta.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index cc0414fd1355..8fde1515aec7 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -100,7 +100,7 @@ + #define MVNETA_DESC_SWAP BIT(6) + #define MVNETA_TX_BRST_SZ_MASK(burst) ((burst) << 22) + #define MVNETA_PORT_STATUS 0x2444 +-#define MVNETA_TX_IN_PRGRS BIT(1) ++#define MVNETA_TX_IN_PRGRS BIT(0) + #define MVNETA_TX_FIFO_EMPTY BIT(8) + #define MVNETA_RX_MIN_FRAME_SIZE 0x247c + #define MVNETA_SERDES_CFG 0x24A0 +-- +2.30.2 + diff --git a/queue-4.14/series b/queue-4.14/series index 3c1734ee757..ee016092f54 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -4,3 +4,9 @@ revert-usb-serial-ch341-fix-character-loss-at-high-transfer-rates.patch usb-serial-option-add-new-vid-pid-to-support-fibocom-fg150.patch usb-dwc3-gadget-fix-dwc3_calc_trbs_left.patch usb-dwc3-gadget-stop-ep0-transfers-during-pullup-disable.patch +ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch +e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch +ip_gre-add-validation-for-csum_start.patch +xgene-v2-fix-a-resource-leak-in-the-error-handling-p.patch +net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch +usb-gadget-u_audio-fix-race-condition-on-endpoint-st.patch diff --git a/queue-4.14/usb-gadget-u_audio-fix-race-condition-on-endpoint-st.patch b/queue-4.14/usb-gadget-u_audio-fix-race-condition-on-endpoint-st.patch new file mode 100644 index 00000000000..401e79422ba --- /dev/null +++ b/queue-4.14/usb-gadget-u_audio-fix-race-condition-on-endpoint-st.patch @@ -0,0 +1,57 @@ +From 7e64bb9f1ab0ba5c02daee8a62ea2e8968d81fdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Aug 2021 11:29:27 +0200 +Subject: usb: gadget: u_audio: fix race condition on endpoint stop + +From: Jerome Brunet + +[ Upstream commit 068fdad20454f815e61e6f6eb9f051a8b3120e88 ] + +If the endpoint completion callback is call right after the ep_enabled flag +is cleared and before usb_ep_dequeue() is call, we could do a double free +on the request and the associated buffer. + +Fix this by clearing ep_enabled after all the endpoint requests have been +dequeued. + +Fixes: 7de8681be2cd ("usb: gadget: u_audio: Free requests only after callback") +Cc: stable +Reported-by: Thinh Nguyen +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20210827092927.366482-1-jbrunet@baylibre.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/u_audio.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c +index 0370a1314b88..af6339ff6d2f 100644 +--- a/drivers/usb/gadget/function/u_audio.c ++++ b/drivers/usb/gadget/function/u_audio.c +@@ -358,8 +358,6 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) + if (!prm->ep_enabled) + return; + +- prm->ep_enabled = false; +- + audio_dev = uac->audio_dev; + params = &audio_dev->params; + +@@ -377,11 +375,12 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) + } + } + ++ prm->ep_enabled = false; ++ + if (usb_ep_disable(ep)) + dev_err(uac->card->dev, "%s:%d Error!\n", __func__, __LINE__); + } + +- + int u_audio_start_capture(struct g_audio *audio_dev) + { + struct snd_uac_chip *uac = audio_dev->uac; +-- +2.30.2 + diff --git a/queue-4.14/xgene-v2-fix-a-resource-leak-in-the-error-handling-p.patch b/queue-4.14/xgene-v2-fix-a-resource-leak-in-the-error-handling-p.patch new file mode 100644 index 00000000000..7e6cb91dd71 --- /dev/null +++ b/queue-4.14/xgene-v2-fix-a-resource-leak-in-the-error-handling-p.patch @@ -0,0 +1,46 @@ +From 9299ed3a087a7ce0a8952eb30e9847e2671d3505 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Aug 2021 09:35:23 +0200 +Subject: xgene-v2: Fix a resource leak in the error handling path of + 'xge_probe()' + +From: Christophe JAILLET + +[ Upstream commit 5ed74b03eb4d08f5dd281dcb5f1c9bb92b363a8d ] + +A successful 'xge_mdio_config()' call should be balanced by a corresponding +'xge_mdio_remove()' call in the error handling path of the probe, as +already done in the remove function. + +Update the error handling path accordingly. + +Fixes: ea8ab16ab225 ("drivers: net: xgene-v2: Add MDIO support") +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/apm/xgene-v2/main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/apm/xgene-v2/main.c b/drivers/net/ethernet/apm/xgene-v2/main.c +index 0f2ad50f3bd7..7f37e7cb687e 100644 +--- a/drivers/net/ethernet/apm/xgene-v2/main.c ++++ b/drivers/net/ethernet/apm/xgene-v2/main.c +@@ -691,11 +691,13 @@ static int xge_probe(struct platform_device *pdev) + ret = register_netdev(ndev); + if (ret) { + netdev_err(ndev, "Failed to register netdev\n"); +- goto err; ++ goto err_mdio_remove; + } + + return 0; + ++err_mdio_remove: ++ xge_mdio_remove(ndev); + err: + free_netdev(ndev); + +-- +2.30.2 +